(19) 



J 



EuropSisches Patentamt 
European Patent Offic 
Office europeen des brevets 



(12) 



(43) Date of publication: 

15.05.2002 Bulletin 2002/20 

(21) Application number: 00309806.8 

(22) Date of filing: 06.1 1 .2000 



(11) EP 1 206 067 A1 

EUROPEAN PATENT APPLICATION 

(51) int CI 7: H04L 12/24. H04L 12/26 



(84) 


Designated Contracting States: 


• Goldsacic, Patrick 




AT BE CH CY DE DK ES Fl FR GB GR IE IT LI LU 


Chipping Sodbury, Bristol BS17 6HX (GB) 




MC NL PT SE TR 






Designated Extension States: 


(74) Representative: Coker, David Graeme et al 




AL LT LV MK RO SI 


Agilent Technologies UK Ltd, 






Legal Department, 


(71) 


Applicant: Agilent Technologies, Inc. (a Delaware 


M/SCSC1GM2, 




corporation) 


Eskdale Road, 




Palo Alto, OA 94303 (US) 


Wlnnersh Triangle 






Wokingham, Berks RG41 5DZ (GB) 


(72) 


Inventors: 




• 


Love, Simon 






Edingburgh EH9 2LU (GB) 





(54) Method of and apparatus for network measurement 



(57) A method and apparatus for measuring param- 
eters of a communications network is described, in par- 
ticular to be applied in the measurement of round trip 
delays affecting data transfer in network communica- 
tions. A data stream Is monitored by probes (1 0,15) at 
least at first and second points in the network (5) and 
the time of occurrence at a first point of a first identifiable 
event (50) In a first direction in the data stream which 



has a counterpart identifiable event (55) in a second di- 
rection in the data stream is recorded and the time of 
occurrence of the counterpart identifiable event at a sec- 
ond is recorded. Similarly, the time of occurrence of the 
first identifiable event at the second point and the time 
of occurrence of the counterpart identifiable event at the 
second point is recorded and the data obtained corre- 
lated (35) to obtain round trip delays for particular trans- 
actions on the network. 
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Description 
Introduction 

5 [0001] The present invention relates to a method and apparatus for measuring parameters of a communications 
network. The Invention may in particular be applied In the measurement of round trip delays affecting data transfer in 
network communications. 

[0002] Modem telecommunications and data networks are used extensively for a range of applications, from data 
transfer to running remote applications over a network. It Is important to monitor the health and performance of such 
10 networks to ensure the continued smooth performance of applications and to spot potential problems. Potential prob- 
lems in a network can include lack of response In an application, slow remote data retrieval times and general latency 
problems encountered in network operations. 

[0003] Problems can arise from a variety of different sources such as the architecture of the network, bandwidth 
considerations, and usage patterns. Latency times In a network can have different sources, with physical distances 
15 and components such as routers and switches contributing to overall performance. Congestion may occur due to lack 
of processing power with the network server unable to run applications satisfactorily. The amount of network traffic 
may be too high for the network bandwidth and configuration chosen, leading to high levels of congestion. Similarly, 
network usage may peak at certain times leading to intolerable levels of congestion. 

[0004] It is desirable to be able to obtain an accurate measure of network performance. Any such method should 
20 take Into account the various factors Involved which may adversely affect the accuracy of the measurements. 

[0005] One method of monitoring network performance is to measure application flow In temns of round-trip delay of 
events in a data stream. For, example, the well known "ping" measurement reports the elapsed time between sending 
a frame to a Internet protocol (IP) node and receiving a response. Although this gives an indication of network layer 
perfonnance it provides only a limited measure overall about how the network is perfomnlng at an application level. 
25 Another drawback typical of this type of method is that some common types of Injected traffic, such as ICMP used for 
"ping" measurements, may be treated differently by the network. The traffic may be treated with a lower priority than 
other traffic or take different routes. Some networks may even disable this type of traffic. 

[0006] It Is also possible to simulate application traffic over a network, executing dummy operations or executing 
lower-layer operations through the use of, for example, agent-based software. The disadvantages of such approaches 
30 are that they only measure approximations of network behaviour and are limited to a particular network path. Use of 
such methods also involves added server overheads, thus skewing any results, obtained. 

[0007] Another method is to observe and measure data flow in the network, identifying and measuring the elapsed 
time between specific correlated events In the network, such as request-response pairings. An example of a request- 
response based system Is marketed by NetScout Systems, Inc. of Westford, Massachusetts, In which measurements 
35 are made by client and server agents, and stored in a local Management Infonnation Base (MIB) indexed by client and 
server. Measurements are carried out at specified points in the network located close to the application server and 
major groups of clients, averaged and brought together to deliver an average round trip delay between the client and 
server, 

[0008] Although such approaches can give averaged approximations of network perfonnance using round-trip timing 
40 results, the information they provide can lack resolution about the network under observation and be over-dependent 
upon agent location within the network. One may desire to observe the performance of the network more closely, for 
example on a transaction by transaction basis. Timing synchronisation Issues may also affect any measurements 
made. Such approaches can also lack portability and scalability over different networks and the different circuit routes 
possible within a network. 

45 [0009] The present invention seeks to provide an improved method and apparatus for measurement of transmission 
delays in a network. 

[0010] The invention provides a method of measuring round-trip delay affecting data transfer in a data network, the 
method comprising the steps of: 

so (a) monitoring a bi-directional data stream at respective first and second monitoring points in the network to Identify 

events relating to said data transfer and being of Interest for said measurement; 

(b) Identifying among the events at each monitoring point occurrences of first and second events travelling as part 
of said data stream In first and second directions, said first and second directions being respectively from the first 
monitoring point to the second monitoring point and back again; 
55 (c) determining as a first time interval the interval between the first and second events at the first monitoring point; 

(d) determining as a second time interval the Interval between the first and second events at the second monitoring 
point; and 

(e) processing said first and second time Intervals so as to determine a round-trip network delay between said first 
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and second monitoring points. 

[001 1 ] By such a method, round-trip delay can be measured independent of any delay between the first and second 
events at said second monitoring point, and independently of any difference between the time references local to each 
5 monitoring point. Accordingly, synchronisation between monitor time references in different parts of world is not critical 
to the accuracy of the measurement. 

[0012] In a preferred embodiment, the identification step (b) comprises selecting the first and second events such 
that the second event Is a response to the first event. 

[0013] By recording stimulus/response times and establishing a flow record summarising a particular transaction, it 
10 is possible to match records from multiple measurement points and produce a round-trip delay measurement for that 
particular transaction. The set of transactions can be operated upon according to user defined criteria. This allows for 
increased accuracy and scalability over existing solutions. Packet and stream identification is possible for both direc- 
tions of a bi-directional data stream. 

[0014] There are many examples of stimulus and response packets or events within a typical data stream-oriented 
15 protocol, for example, the packets that make up the set-up or tear-down handshakes in a data stream. 

[001 5] The step (a) may comprise recording a plurality of events and their occurrence times at a respective monitoring 
point without specifically identifying said first and second events, the recorded events including Identifiers which can 
be correlated to identify said first and second events, the identifying step (b) being perfomned using said identifiers 
together with the occurrence limes. 
20 [0016] The identifiers may be identifiers extracted from the data stream its elf. Alternatively or in addition, the identifiers 
may include an element generated locally by a monitoring station. 

[0017] For example, a data packet may be identified as belonging to a particular data stream by extracting the end 
points from the packet or by recognising an explicit data stream identifier. Where the data stream identifier is not 
sufficiently unique across time, it can be augmented with a timestamp or other locally-generated element. 
25 [0018] In embodiments where an identifier contained within the data stream is only locally unique, for example as in 
Asynchronous Transfer Mode (ATM), the step (b) may include mapping from locally unique identifiers to a globally 
unique identifier, by referring to a configuration database. 

[0019] The step (a) may be performed by a combination of first and second monitoring stations remote from one 
another and connected to the network at the first and second monitoring points respectively, while at least step (e) is 
30 perfomned by a processing station remote from at least one of said monitoring stations using data recorded by said 
monitoring stations. The monitoring stations may in particular use respective local time references without invalidating 
the measurement. 

[0020] The steps (b), (c) and (d) may be perfomned at the respective monitoring stations in addition to step (a), or 
may be performed at said processing station. In this way the first and second time intervals for each monitoring point 
35 can be directly represented in the records generated, rather than the individual event occurrence times. This allows 
both the data volume and the processing burden at the processing station to be reduced. 

[0021] The step (e) may in particular comprise measurement of round-trip delay measurements for various data 
streams by taking the difference of said first and second intervals for pairs of first and second messages representing 
stimulus and response in respective data streams. 
40 [0022] All, some or none of the steps (b) to (e) may be performed in real time as events occur, or may be performed 
in batches only. For example, steps (b), (c) and (d) may be performed continuously by the monitoring stations, which 
then report their results in batches for processing according to step (e). 

[0023] The various steps of the method as set forth above can conveniently be implemented in various combinations 
of both hardware and software, for example in a single digital signal processor chip, although of course hard-wired 
45 arrangements could be used instead. 

[0024] The invention yet further provides an apparatus for measuring round-trip delay affecting data transfer In a 
data network, the apparatus comprising means arranged to. perform the steps of a method according to the invention 
as set forth above. 

[0025] The apparatus may comprise: 

so 

a first monitoring station adapted for connection to a network at a first monitoring point and including means ar- 
ranged to perform step (c) of the method according to one embodiment of the invention as set forth above; 
a second monitoring station adapted for connection to a network at a first monitoring point and including means 
arranged to perform step (d) of said method; and 
55 ^ B processing station adapted for perfomning step (e) of said method. 

[0026] Th apparatus may alternatively comprise first and second monitoring stations each adapted to perform the 
step (a) of the method to generate a record of occurrence times and Identifiers for a plurality of events at a respective 
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monitoring point without specifically identifying first and second events, and a processing station adapted to receive 
the records from the monitoring stations and to perfomi the steps (b), (c) and (d), based on the received records. 
[0027] The processing station may be separate from either monitoring station, or integrated with one of the monitoring 
stations. 

5 [0028] The invention yet further provides a network probe apparatus comprising all the monitoring station technical 
features of an apparatus according to the invention as set forth above. 

[0029] The invention yet further provides a processing apparatus comprising all the processing station technical 
features of an apparatus according to the invention as set forth above. 

[0030] In a further aspect of the invention, it is also possible to calculate the Loss In a signal between the two mon- 
. 10 itoring points by correlating the two flow records and comparing the traffic counts. 

[0031 ] Yet further aspects of the invention and optional features, together with their advantages, will be apparent to 
the skilled reader from the description of specific embodiments which follow. 

BRIEF DESCRIPTION OF THE DRAWINGS 

15 

[0032] Embodiments of the invention will now be described, by way of example only, by reference to the accompa- 
nying drawings, in which: 

Figure 1 shows measuring apparatus according to an embodiment of the invention connected to a telecommuni- 
20 cation network; 

Figure 2 is a timeline diagram illustrating the monitoring of stimulus and response messages transmitted as part 
of a data stream between two stations of the network in the apparatus of Figure 1 ; 

25 Figure 3 is a timeline diagram illustrating a method of measuring round-trip delay between first and second mon- 

itoring points implemented by the apparatus of Figure 1 ; 

Figure 4 is a diagram showing steps involved in the operation of the system for calculating round-trip delay. 

30 Figure 5 is a flow diagram showing steps Implemented by monitoring stations In calculating stimulus and response 

times; and - - 

Figure 6 is a flow chart of a process for constructing flow records implemented in the monitoring stations. 

35 DETAILED DESCRIPTION OF THE EMBODIMENTS 

[0033] Figure 1 shows schematically a communications network 5 to which are connected stations A and B and two 
monitoring probes 1 0, 15. Thetemn "probe" is used herein to referto a functionally self-contained system or sub-system 
designed to carry out the required data gathering (and perhaps preliminary analysis) for a bearer in a network circuit. 
40 Each probe 10, 15 is connected to a bearer at a respective measuring point 26, 30 and monitors a bl-dlrectlonal data 
stream 20 flowing between stations A and B. The probes 10, 15 are connected to a correlator component 35, so as to 
complete the measurement apparatus. The correlator component 35 may be located remotely and conveniently form 
the probes 10, 15, for example as a suitably equipped computer. 

[0034] Networi< "clouds" 40 here indicate spatial and structural separation between to the measurement points 25, 
45 30 in addition to systems A and B. The network may be any capable of transmitting bi-directional data stream such as 
ATM or Transfer Control Protocol (TCP). The probes 1 0, 1 5 can be deployed at different locations across such a network 
in a variety of configurations. It is possible to implement the monitoring system using a larger number of probes than 
is shown. Using known techniques individual circuits within a network can also be identified and probed separately in 
order to assemble a more accurate record of events within the network. 
50 [0035] Figure 2 is a timeline diagram, in which time is shown as flowing down the figure. Each point on the network 
is represented by a vertical line, with the transmitting systems A and B at left and right respectively. The broken line 
labelled X roprGsents the location where a single probe 45 is connected to the network at some convenienttapping point. 
[0036] A stimulus 50 and a response 55, represented here by diagonal arrows, are transmitted on a data stream 
between system A to system B. This shows the progression of the stimulus 50 and response 55 packets across a 
55 network 5. The stimulus and response may for example be handshaking messages Involved in the setting up of a voice 
or internet protocol (IP) connection. 

[0037] The round-trip delay as seen at X for this stimulus/response pair through the network, as seen by the probe 
45, is composed of three components: a first traversal delay 65 from the probe 45 to System B, the response delay 70 
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of System B before a response 55, and a s cond traversal delay 75 from System B back to the probe 45. The values 
of these component delays are, however, not distinguishable at the probe. The probe 45 measures only the total 
stimulus/response delay 60, which will be greater than the stimulus/response delay within system B and less than the 
delay seen at system A. 

5 [0038] In order to calculate the actual round-trip delay of a transaction , calculations involving the different measurable 
components in the round trip delay must be made. Given that the System B and the probe location 45 may be thousands 
of kilometres apart, and administered by different authorities, there is not generally even a common time reference 
source which could be used to compare the arrival and departure times of events at different locations, for this purpose. 
[0039] Figure 3 is a diagram showing stimulus/response delays t_SR_X and t_SR_Y and components thereof, as 

10 measured by the two probes 10,15 respectively in the arrangement of Figure 1 . Here the broken lines X and Y represent 
the locations of where the first and second probes 10, 15 connect to the networlc. 
[0040] The stimulus/response delay (round trip delay) as seen by probe 10 is composed of: 

t_SR_X = t_out_X + t_System + t_back_X 

where: 

l_out_X is the lime taken for the stimulus to travel between the probe 10 at point X and System B; 
20 t_System is the system response time; and 

t_back_X is the time taken for the response to travel between System B and the probe 1 0 at point X. 

[0041] Similarly, the stimulus/response delay as seen by probe 15 measuring at point Y is: 

t_SR_Y = t_out_Y + t^System + t_back_Y 

where 

30 t_out_Y is the time taken for the response to travel between point Y and System B; 

t^System is the is the system response time; and 

t_back_Y is the time taken for the response to travel between System B and point Y. 
[0042] Other components shown on the diagram are: 

35 

t_out_XY, the time taken for the stimulus to travel between X and Y; and 
t_back_XY, the time taken for the response to travel Y and X. 

[0043] These last two components and the system response time t_System are not known in practice. However, the 
40 difference between measurements t_SR_X and t_SR_Y gives the total of the time taken for the stimulus to travel from 
probe point X to point Y and the time taken for the response to travel back from Y to X. This difference is the round- 
trip delay between the probe points X and Y 
[0044] The actual round-trip delay is calculated by the following: 

45 "~ 

t_SR_X - t_SR_Y ^ . 

= t_out_X + t_System + t_back_X - (t_out_Y + t_System + t_back_Y) 
so = (t_out_X - t_out_Y) + (t_System - t^System) + (t_back_X - t_back_Y) 

= t_out_XY + t_back_XY 
= round-trip delay between probes X & Y. 

55 

[0045] It will be seen that the unknown time components such as t_System (system response time) which are present 
as components of both measurements cancel each other out. Since the component measurements are each only made 
at a single site and are of duration rather than absolute times, then the accuracy of the measurement is not dependent 
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on the accuracy of the synchronisation of the clocks of the probes. 

[0046] Having explained the theoretical basis for the measurennent of round-trip delay in the systenn of Figure 1 , the 
operation and structure of the measurement system In practice will now be explained. 

[0047] Figure 4 is a diagram showing steps involved in the operation of the system for calculating round-trip delay. 

5 The procedure of measuring the round-trip delay of a transaction is conveniently implemented in two stages: individual 
measurements that are made in the same way at all the probes, and a measurement that Is made at the correlator to 
calculate the round trip delay between the probes. It is for this reason that the probes 10, 15 and the correlator 35 are 
shown as separate functions in the apparatus of Figure 1 , although the correlator and at least one of the probes may 
be integrated in one piece of equipment If desired. 

10 [0048] The first step 80 in the operation of the system is initialisation by the user. This can include whatever various 
tasks are needed to start up and setup the system to enable measurements. 

[0049] At 82 and 84 the type of task needed to identify the bi-directional data stream is analysed and the probes 
configured, respectively. Different protocols, such as IP and ATM, can have different methods of representing stream 
identifiers. The system must take this into account to be able to uniquely identify a bi-directional data stream at any 
15 point, and identify what resources are needed and what procedures are to be followed. 

[0050] At 84 the probes are configured. This will generally require distribution of a configuration database 86 which 
enables a probe to be uniquely identified In the context of the network and is used In the production of flow records by 
probes. Additional operating parameters can beset at this stage. 

[0051] The pre-moniloring and configuration steps at 82 and 84 are described in greater detail below. 

20 [0052] Next, the probes are instructed 88 to monitor the network and flow records are constructed at 90, by each 
monitoring station separately. This involves monitoring data streams and compiling flow records for later correlation 
and processing. Some processing may be performed in the monitoring station, as detailed further below. The Instruction 
can define criteria for filtering the message streams to Identify those of interest. By monitoring a bi-directional data 
stream at respective first and second monitoring points In the network and identifying corresponding stimulus and 

25 response events. The actual component measurements made by the probe of the system are shown in Figure 3 and 
described above. The data stream analysis made by the probe components of the system in order to compile the flow 
records are detailed later. 

[0053] The records from two monitoring stations are then processed for correlation 92. Input from the configuration 
database 86 may be required at this stage in order to match up flow records for corresponding stimulus and response 

30 events. 

[0054] The next step 94 is to subtract the time delays t_SR^X and t^SR_Y for the corresponding stimulus and re- 
sponse events, which have been recorded by the two monitoring stations and correlated with one another. This provides 
the components shown in Figure 3 . This produces the actual round-trip delay measurement which is reported and/or 
recorded at 96 via displays, communication links as appropriate. 
35 [0055] Figure 5 is a flow diagram showing steps in monitoring the traffic at each monitoring point, to calculate stimulus 
and response time intervals. 

[0056] A number of the state machines as depicted by the flow diagram of Figure 5 can be active within one probe 
at any one time. This would be the case where a single probe is monitoring multiple bi-directional data streams being 
carried on the same physical bearer This type of set-up and use would be a standard mode of operation for the probe. 

40 [0057] At 1 00 activity is detected on the network bearer being monitored by the network probe. Input from a network 
configuration database 86 may be needed in order to correctly identify the nature of the data stream detected. At a 
next stage 1 05 the network activity being monitored is tested to ascertain whether or not it Is a stimulus signal in a first 
direction, according to the filtering criteria defined by the task in hand. These stages can be likened to a first state of 
the process, viewed as a state machine. If there is no stimulus matching the filtering criteria then there no action is 

45 perfonned and the process returns to 100. 

[0058] On detecting a stimulus in a first direction, a stimulus time record Is first updated 110, and then a second state 
of the stale machine is entered. Further network activity is detected 115 and tested 120 to ascertain whether or not it 
is a response to the stimulus detected and identified at 1 00, 1 05. Again, input from a network configuration database 
86 may be needed in order to correctly Identify the nature of the data stream detected. If no response is detected then 

50 no action is performed. On detecting a response, however, a response time record is updated at 125. The stimulus- 
response time interval is now calculated at 130 and the flow record updated at 135. After the flow record has been 
updated 135 the system returns to detecting input and testing for a stimulus signal. 

[0059] The steps depicted in Figure 5 can be carried out within the probe and the results passed to a separate 
component for processing to provide the round trip times. The correlator component receives the stimulus/ response 
55 times and flow records and process s them to provide the final result. 

[0060] Alternatively, only the steps involving detection of the stimulus times and response times need be carried out 
within the probe component of the system. Data comprising the event details and times can be passed on directly to 
the correlator component without being processed, the correlator carrying out the necessary calculations to produce 
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the stimulus/ response time intervals. 

[0061] In either case, results can be passed on to the correlator component either as bulk data or on a record-by- 
record basis. It will be appreciated that the same process can be conducted In parallel at several monitoring points, 
and for several streams at each monitoring point, whether implemented as a state machine or otherwise. 
5 [0062] The bi-directional data stream 20 can be according to various network protocols, for example ATM or TCP. 
The probes are capable of monitoring a bearer between two systems A and B and examining transmitted packets. 
[0063] Each probe constructs a data stream record that contains one or more of the stimulus and response times. 
Where there are multiple stimulus and response measurements they can be identified either by their order or through 
the addition of a timestamp. 

10 Within a data stream-oriented protocol there are stimulus and response packets that can be recognised by the probe, 
for example the packets that make up the set-up or tear-down handshakes between systems. Each Individual probe 
in the system is able to measure the time at which it receives a packet that it recognises as indbating a stimulus or 
response event. 

[0064] Any data stream visible to the probes 10, 15 should be uniquely identified in a manner that allows it to be 
IS recognised at any point in the network 5. A packet can be identified as belonging to a particular data stream, either 
through extracting the end points from the packet or by recognising an explicit data stream identifier. Where the data 
stream Identifier is not sufficiently unique across time It can be augmented with a timestamp. This Is carried out for 

both directions of a bi-directional data stream. 

[0065] In technologies such as ATM where the data stream identifier is only locally unique mapping is carried out 
20 from the locally unique identifier to a globally unique identifier by referring to a configuration database. This configuration 
database may be in the fomn of a Management Information Base (MIB), of a type known to those skilled in the art. At 
any point in the network where the data stream 20 is visible, the probes 10, 15 can measure the time at which they 
observe a pair of recognisable events, one in each direction. These events can be of the form of a stimulus and re- 
sponse, for example the set-up request for a TCP connection and the acknowledgement from the requested entity. 
25 [0066] In practice, each probe builds a flow record summarising particular transactions for the data stream, some of 
which are the timestamps of the stimulus/response event pairs, and from these the stimulus/response event time 
calculate can be calculated. Within the probe, packets are classified according to the bi-directional data stream that 
they belong to and the direction of flow within the data stream. A flow record is then built for each bi-directional data 
stream and output either when the data-stream is terminated, or on a defined time-boundary. The flow record in this 
30 embodiment contains basic statistics and the stimulus-response time Intervals which are calculated according to Figure 
4. Measurements do not depend on knowledge of the topology of the network that Is carrying the data stream, the only 
constraint being that the data stream has to be visible to two (or more) probes. 

[0067] Each probe is capable of building multiple flow records in parallel, with each record summarising a particular 
data stream being carried on the physical bearer. 
35 [0068] A flow record for a bi-directtonal data stream contains at least fields containing information on the data stream 
identifier and stimulus and response times. 

[0069] The data stream identifier is an identifier that allows the data stream to be uniquely identifier. This can take 
a number of forms such as: 



"^0 . Global Data Stream ID - an identifier that identifies the bi-directional data stream across the whole network. 

Local Data Stream ID - an identifier that identifies the bl-dlrectlonal data stream within the context of a physical or 
logical bearer. 

Global Bearer ID - the identifier that identifies the bearer in the context of the network. 
Local Bearer ID - the identifier that identifies the bearer In the context of a probe. 
45 - Probe ID - the Identifier that uniquely Identifies a probe In the context of the monitoring network. 

[0070] In the case of the Stimulus-Response lime it is possible to collect more than one stimulus-response lime for 
any flow record, for example, for the opening handshake and the closing handshake of a transmission. 
[0071] Other flow statistics can also be included, such as traffic counts of the number of bytes, the number of packets 
so that have been transmitted, or counts of specific types of packet that have been seen (for example, the number of 
particular signalling packets). 

[0072] It is also possible to calculate Loss between the two monitoring points by correlating the two flow records and 
comparing the traffic counts. 

[0073] Figure 6 is a flow chart of the task analysis step 82. This shows the initial pre-monltoring stages of operation 
55 where the task is analysed in terms of data stream protocols, addressing conventions and the like, and how the con- 
figuration database is distributed as appropriate for use in constructing the flow records. Using pre-monitoring analysis 
aids in speeding the actual monitoring process and calculation of the round trip delay, saving on system resources. 
[0074] It will be appreciated that different conditions will apply depending on the application and the protocol types 



7 



BNSDOCID: <EP l20e067A1J_> 



it 



EP 1 206 067 A1 

being monitored. For nnaximum flexibility, the present apparatus is able to adapt between these different situations, as 
will now be explained. Three possible routes to constructing a flow record from a bi-directional data stream are shown 
in this example. These examples are for the cases where Reconfiguration database is distributed to the probes, either 
in entirety or in part, or where the configuration database is not distributed to the probes at all. 

5 [0075] The first step 150 is for the apparatus to setup for monitoring, including setting of task parameters and deter- 
mination of what protocol the data stream uses. The next step 1 52 Is to detemriine if a configuration database has been 
distributed to the probes. This Is important in deciding how the flow records will eventually be constructed. If configu- 
ration database has not been distributed, then a "bottom up" method will be followed 155. If the configuration database 
has been distributed to the probes in any way then an alternative method is followed 1 60. Either a "top down" 1 65 or 

10 a "hybrid" 170 approach will be taken dependent on the how the configuration database has been distributed. If the 
whole of the database has been distributed then the top down process is followed. If only a part of the database has 
been distributed then the hybrid 170 process is followed. 

[0076] In the case for the bottom up method, where no configuration database has been distributed to the probes, 
the apparatus determines how the flow records will be identified for correlation. To do this, a set of local identifiers are 
15 extracted 180 from the data stream which are used to extract 185 a unique global data stream identifier from the 
configuration database 86. The local identlfier(s) used to extract the global Identifier can be built up from such local 
Identifiers as the local stream ID in addition to local bearer ID and probe ID. Once this information has been extracted 
the apparatus then proceeds 1 95 with correlating the data streams and calculating the round-trip delay time as de- 
scribed in Figure 4 above. 

20 [0077] In certain technologies such as IP there may be a local data stream ID such as a connection identifier, iden- 
tifying connection end points, that allows the flow records to be correlated without consulting the configuration database 
86. 

[0078] Where at least part of the configuration database has been distributed the apparatus determines at step 1 62 
if the whole of the configuration database has been distributed to the probes, in which case a top down method will be 
25 followed 1 65. The apparatus in this case does not need to distribute any configuration data or extract other identification 
data to the probes from the data stream. The apparatus can now proceed 200 in constructing flow records, correlation 
and calculation, as described above. Any flow records produced by the probes will in this case automatically use the 
global data stream ID. 

[0079] Where only some aspects of the global configuration is distributed to the probes a hybrid method will be 
30 followed 170. This is the case when the ID distributed to the probe, for example the global bearer ID, can only partially 
identify the data stream probedv In such a case local identifiers are extracted.205 in order to construct a unique identifier, 
[0080] The probe needs to be able to identify and associate the two directions of the bi-directional stream. There 
are two approaches to this dependent upon the technology being monitored. As discussed elsewhere, for technologies 
such as ATM the two directions share a local data stream ID, VPIA/CI for ATM. A check 207 for a common local data 
35 stream ID is carried out. If a common local data stream ID is recognised 210 then the two directions are associated 
21 5 based on recognition of this common ID. When this step has been completed the apparatus can then proceed 220 
in constructing flow records, correlation and calculation, as described above. 

[0081] Where no common local ID can be identified an alternative method is followed 225 by the apparatus. The 
configuration mapping the data stream direction and the local data stream ID to a single global data stream ID is 
40 propagated to the probe using information from the configuration database 86, The two directions can now be asso- 
ciated 230 via the global data stream ID. The apparatus can then proceed 235 in constructing flow records, correlation 
and calculation, as described above. 

[0082] The data stream record is flushed from the probe on a time boundary or when the data stream under consid- 
eration is completed. When a data stream record is flushed from the probe it is written to the correlator 35 function, 

45 which can match the records for the same data stream (seen Independently by different probes) by matching the data 
stream identifiers. The correlator Is able to produce round-trip delay measurements for the various data streams by 
taking the difference of their stimulus/response limes, using the equations given above, or equivalents. 
[0083] The correlator 35 can receive flow records from many probes, although in this embodiment measurements 
are possible using only two probes. Flow records are brought together from the chosen measurement points and exactly 

50 matched so that the round trip delay for a particular transaction can be calculated. The correlator function can be 
implemented as a single function or distributed through a larger system. 

[0084] The skilled reader will appreciate that the invention is not limited to the specific implementations and appli- 
cations detailed above. It can be implemented in various combinations of hardware and software, and with our without 
hardwired or programmable circuits. The various components of the probe and correlator functions described could 
55 be replaced by a general purpose computer, for example a personal computer such as a notebook PC, interfaced to 
the network by the appropriate hardware. Another implementation is a handheld device with the appropriate hardware 
connectivity and embedded processor with software. 

[0085] The recorded data can be processed on a continuous basis, or recorded, brought together and processed 
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much later, on an off-line basis. 

[0086] The probe system and correlator function may also be integrated Into part of some other network analysis 
package. The various components needed to perfomri the tasks of probing the network, collecting data and calculating 
results from that data may be distributed and physically remote from each other with, for example central server cor- 
5 relating the data gathered by remote probe stations. 



Claims 

10 1 . A method of measuring round-trip delay affecting data transfer in a data network, the method comprising the steps 
of: 

(a) monitoring a bi-directional data stream at respective first and second monitoring points in the network to 
identify events relating to said data transfer and being of interest for said measurement; 
15 (b) identifying among the events at each monitoring point occurrences of first and second events travelling as 

part of said data stream In first and second directions, said first and second directions being respectively from 
the first monitoring point to the second monitoring point and back again; 

(c) determining as a first time interval the interval between the first and second events at the first monitoring 
point; 

20 (d) detenmlning as a second time interval the interval between the first and second events at the second 

monitoring point; and 

(e) processing said first and second time intervals so as to detennine a network delay between said first and 
second monitoring points. 

25 2. A method according to claim 1 wherein the identification step (b) comprises selecting the first and second events 
such that the second event is a response to the first event. 

3. A method according to claim 1 or 2 wherein packet and stream identification is for both directions of a bi-directional 
data stream. 

30 

4. A method according to any of claims 1 to 3 wherein the step (a) comprises recording a plurality of events and their 
occurrence times at a respective monitoring point and wherein those events are specifically identified, the identi- 
fying step (b) being performed using said identified events together with the occurrence times. 

35 5. A method according to any of claims 1 to 3 wherein the step (a) comprises recording a plurality of events and their 
occurrence times at a respective monitoring point without specifically Identifying said first and second events, the 
recorded events including identifiers which are correlated to identify said first and second events, the Identifying 
step (b) being performed using said identifiers together with the occurrence times. 

40 6. A method according to claim 5 wherein the identifiers are identifiers extracted from the data stream itself. 

7. A method according to claim 5 wherein the Identifiers include an element generated locally by a monitoring station. 

8. A method according to claim 5 where the data packet Is identified as belonging to a particular data stream by 
45 extracting the end points from the packet or by recognising an explicit data stream Identifier. 

9. A method according to claim 5 wherein the Identifiers are the packets that make up the set-up or tear-down hand- 
shakes in a data stream. 

50 10. A method according to any preceding claim wherein the data stream Identifiers are augmented with a timestamp 
or other locally-generated element. 

11. A method according to any preceding claim wherein the step (b) includes mapping from locally unique Identifiers 
to a globally unique identifier, by referring to a configuration database. 



55 



12. A method according to any preceding claim wherein step (a) is performed by a combination of first and second 
monitoring stations remote from one another and connected to the network at the first and second monitoring 
points respectively, while at least step (e) is performed by a processing station remote from at least one of said 
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monitoring stations using data recorded by said nnonitoring stations. 

13. A method according to any preceding claim wherein the monitoring stations in particular use respective local time 
references without Invalidating the measurement. 

5 

14. A method according to any preceding claim wherein the steps (b), (c) and (d) are performed at the respective 
monitoring stations in addition to step (a). 

15. A method according to any preceding claim wherein step (e) comprises measurements of round-trip delay meas- 
10 urements for various data streams by taking the difference of said first and second intervals for pairs of first and 

second messages representing stimulus and response In respective data streams. 

16. A method according to any preceding claim wherein some or none of the steps (b) to (e) are performed in real 
time as events occur, or are perfonned In batches only. 

IS 

17. A method according to any preceding claim wherein steps (b), (c) and (d) are perfonned continuously by the 
monitoring stations, which then report their results In batches for processing according to step (e). 

18. A method according to any preceding claim wherein said probes monitor a plurality of multiplexed data streams 
^0 across a physical bearer. 

19. An apparatus for measuring round-trip delay affecting data transfer In a data network, the apparatus comprising 
means arranged to perform the steps of a method according to the Invention as set forth In the claims above. 

25 20. An apparatus for measuring round-trip delay affecting data transfer In a data network, the apparatus comprising: 

a first monitoring station adapted for connection to a network at a first monitoring point and Including means 
arranged to perform step (c) of the method according to claim 1 ; 

a second monitoring station adapted for connection to a network at a first monitoring point and Including means 

arranged to perform step (d) of said method; and 

a processing station adapted for performing step (e) of said method. 

21. An apparatus as claimed in claim 20 alternatively comprising first and second monitoring stations each adapted 
to perfomi the step (a) of the method to generate a record of occurrence times and identifiers for a plurality of 

3s events at a respective monitoring point without specifically identifying first and second events, and a processing 

station adapted to receive the records from the monitoring stations and to perfomri the steps (b), (c) and (d), based 
on the received records. 

22. A network probe apparatus comprising all the monitoring station technical features of an apparatus as set forth in 
40 claim 20 or claim 21 , 

23. A processing apparatus comprising ail the processing station technical features of an apparatus as set forth in any 
of claims 1 9 to 21 . 

45 24. An apparatus according to claim 20 or claim 21 wherein said probes monitor a plurality of multiplexed data streams 
across a physical bearer. 

25. A method for calculating the loss in a signal between the two monitoring points by correlating two flow records and 
comparing the traffic counts in accordance with the method described in any of clalrhs 1 to 18. 

so 
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